Disclaimer
🚨 Warning
The post is barely a collection of tools (with inappropriate content stripped) for my future reference, and will NOT get updated regularly as I maintain it inside Obsidian now.
It contains content including:
- How to exploit RCM so one can run custom firmware on Switch
- How to run games one dumped from legitimate game cartridges
- How to have a super fancy quadra-boot console1
- Recommended Apps on Switchroot (Android)
- Extra tips about emulation
However, it WILL NOT tell you:
- How/Where to download pirated games
- How to install unauthorized game copies on Switch
- How to weld inner circuit to make patched Switch RCM-exploitable
- How to do resource unpacking of Switch games
- How to play DOOM on all quadra-boot systems
Basics
- Glossary of common hacking terms
- Switch System Flaws
- FAQ
- FAQ by Atmosphère developer ReSwitched: Not meaningfully updated since 2019, but still relevant
- Can you get banned for using SwitchRoot?
- Created emuMMC and never went online on cfw but switch still banned.
- Difference between payload=bootloader/payloads/fusee.bin and fss0=atmosphere/package3 in hekate_ipl.ini
payload=
or thePayloads
button in Hekate will “chain-load” or load another payload without using Hekate’s launch configs. Things such asemummcforce=1
will be ignored. And atmosphere will use it’s own configsfss0=
will load a payload from Hekate with Hekate’s configs telling what settings it should use. Configs likekip1patch=nosigchk
in the launch config options will be used- if you have a mixed-mode environment where you have an emuNAND and a sysNAND, you cannot use
payload=bootloader/payloads/fusee.bin
to boot into your sysNAND; it does not respect the value ofemummc_force_disable
.
Exploit
RCM
- RCM-exploitable by SN
- RCM exploitation method: Jig preferred
- RCM Payload Injectors
- Shorted Ports: Right joy-con pin 9-10
Exploiter
- Windows: TegraRcmGUI (Fusée Gelée exploiter)
- Android: Rekado
- Linux
- fusee-nano, C, recommended
- fusee-interfacee-tk, Python
Payloads
- fusee: bundled with Atmosphère
- hekate_ctcaer: hekate, obviously…
- Lockpick_RCM: Dump
*.keys
- my mirror of updated fork (fork on GitHub 404 now)
- original down due to DMCA
SD Card/switch/*.keys
suyu/user/keys/*.keys
ryujinx/portable/system/prod.keys
SAK_64bit/bin/*.keys
NxFileViewer/prod.keys
- TegraExplorer: file explorer
Software
Bundle
DeepSea is a good starting point for beginners. Check Featuring list in README.
💡 Tip
DeepSea is usually outdated so you’d better just start here and move on to respective repos.
Someone also offers a bundle named HATS but I prefer to not discuss it publicly.
Tool
- hekate, bootloader
- Atmosphere, firmware
bootloader/payloads
, see #Payloads- nxDumpMerger, Python Script to Convert
Cartridge Image (XCI)
Files - NxFileViewer
- Switch Army Knife: XCI / NSP / NSZ Format Conversion, archived
- Switch-Toolbox: Resource Unpacking, archived
NRO
A small list of homebrew apps I use, there are more in NH Switch Guide
- bundled with Atmosphère
- Daybreak, offline firmware installer
- appstore, homebrew app store, obviously
- haze, no idea
- JKSV, Save Manager
- wiliwili : BiliBili Player
- PPSSPP for Switch
- See #Cheats for (offline!) single player cheating related stuff
- Play Time Log
- PlayEventParser
- NX-Activity-Log (forked from tallbl0nde, working on HOS 19.0)
- nxdumptool
- Dump XCI/NSP/HFS0/ExeFS/RomFS/Certificate/Ticket from gamecards
- See usage guide at ZeldaMods
- Switch_90DNS_tester, DNS / Hosts to Block Requests to Nintendo Servers, unneeded nowadays as it can be blocked at bootloader (hekate) or system (Atmosphère) level
Overlay
- Setup Guide
- nx-ovlloader: loader service
- Tesla-Menu: first loader
- MissionControl: Use controllers from other consoles natively on Switch via Bluetooth
- sys-con: similar to MissionControl, but for wired controller. This fork works on FW-18.x / Atmosphère-1.7.x (N.B. many controllers only work when UNDOCKED, which renders this sysmodule a little useless IMO.)
- Modules
- ovl-sysmodules: toggle sysmodules on the fly
- sys-clk :CPU Overlocking
- Fizeau: screen filter
- emuiibo
- For cheats, see #Cheats
Streaming
Stream switch games to PC via USB or network w/ 720p@30fps video & 16bit PCM@48kHz stereo audio (can’t be higher due to hardware limit):
- SysDVR (if a game won’t work, try dvr-patches)
- Getting started
- USB Driver Setup
Guides
- NH Switch Guide
- Creating the emuMMC
AutoRCM, not recommended, enable this still requires a device to send payloads.- Keeping your system up-to-date
- Changing SD cards
- Used under Atmosphère
- Atmosphère Configurations
sd:/atmosphere/config/exosphere.ini
:blank_prodinfo_emummc=1
- Blocking Nintendo servers
- Theming
- Atmosphère Configurations
Amiibo
- amiibo-compatible game
- emuiibo & emuiigen
- AmiiboAPI
Linux Host
udev
sudo mkdir -p /etc/udev/rules.d/
/usr/bin/sudo -e /etc/udev/rules.d/10-switch.rules
sudo udevadm control --reload
udevadm trigger
# /etc/udev/rules.d/10-switch.rules
# https://switch.hacks.guide/extras/adding_udev/
# Tegra X1 USB?
SUBSYSTEMS=="usb", ATTRS{manufacturer}=="NVIDIA Corp.", ATTRS{product}=="APX", MODE="0666"
# https://github.com/pheki/nx-udev
# Switch USB
SUBSYSTEM=="usb", ATTRS{idVendor}=="057e", ATTRS{idProduct}=="3000", MODE="0666"
# RCM
SUBSYSTEM=="usb", ATTRS{idVendor}=="0955", ATTRS{idProduct}=="7321", MODE="0666"
Switchroot
Guides
- 15 (aka. LineageOS 22, TBA…)
- 14/U (TBA)
- a real, upstream LineageOS 21 release, with Switch support. Really amazing.
- HAC-001
- Known bugs that I care as of 2024-07-05: JoyCon autopair, overlocking, Android partition on SD
- 11/R Setup Guide
- Unlike Android 10/Q, Android 11 bundles Gapps by default
- Former “extra zips” section is called Tips & Tricks now
- known bugs
- Be sure to do
Factory Reset
and wipe data and system EVEN IF you don’t have previous Switchroot installation
Apps
- Regular Apps
- Aurora Droid / Neo Store
- Cromite
- Magisk (w/ LSPosed)
- Material Files
- Red Moon
- NekoBox (do NOT download from Google Play, dev account is hijacked)
- Termux
- Gaming
Console Launcher (bundled w/ Switchroot Android 11)- Kirikiroid2_yuri
- Moonlight
- PS Remote Play
- SteamLink
- Xbox
Cheats
- Games cheats
- Homebrew
- NRO: Breeze Beta or EdiZon-SE
- Overlay: EdiZon-Overlay
- Cheat Create Guide
- AMS-Cheat-Button-Assigner: activate button remapping
Database
- Cheat Codes SXOS and AMS Main cheat file (GitHub mirror, used in #usage)
- Sharkive (bundled w/ Checkpoint)
- NX-60FPS-RES-GFX-Cheats
- tomvita/MyNXCheats (from EdiZon-SE/Breeze dev)
- NSW Releases (GitHub)
- If unavailable, try searching game title or titleID on GBAtemp, popular games usually have their own thread
- If you have Breeze, aio-switch-updater or similar NROs, it’s also possible to directly download cheats right inside homebrew
Usage
Edited from r/Ryujinx:
- Get the cheat file from GBAtemp. It is the
title.rar
attached to the first post here. - Extract that RAR file and find the folder
010093801237C000
. You can also just searchMetroid Dread
and you’ll find it. - In that folder is a
cheats
folder. Copy this folder. - Open up Ryujinx and right click on the game file and click on “Open Mods Directory”. This will open a new folder. Paste that
cheats
folder in this new mods folder that opened up. - Go into the
cheats
folder and open up the file49161D9CCBC15DF9.txt
. Remove any cheats you don’t want to activate and only leave the cheats you want to have on. Save the file and close the text editor. (You can also enable only a few of them in Ryujinx GUI) - Now run the game and the cheats should be activated.
In Suyu, instead of standard Atmosphère mod folder, create a new folder and put cheats
in that folder. The whole thing looks like <suyu-path>\user\load\01009BF0072D4000\[1.3] Cheats\cheats\8f75c9b8b7ff69d9.txt
. Note that silly ==[1.3] Cheats
== folder, that’s the point.
The most important thing to get it work is version. Make sure game build ID (and title ID ofc) matches the cheat. Install/Add update before using cheat. If not, try to waste 3 hours searching & debugging like me, only to find out it’s caused by the mismatched NSP :)
Mods
GameBanana is the main source I usually check.
Fire Emblem: Three Houses is somewhat a dating sim or Otome/gal game. Let’s say I want to have a skin mod called Agarthan Academy which would make female characters look more charming.
Usually emulators work a bit differently, so mods created for Switch may not be compatible. This mod offers both versions so no worries. Just download the zip, extract the content and copy it to mod directory (N.B. when using Ryujinx, use the mod directory
instead of Atmosphere mod directory
).
Lakka
- Lakka
- Accessing Lakka filesystem
- Upgrading Lakka
- L4T Lakka Install/Update Guide
- Multitaps
- Netplay
- No need to install, just replace
lakka.ini
bootloader profile and content insidesdmc:/lakka
. - No need to do a reinstall when upgrading, just use Lakka built-in updater.
- To upgrade offline, download tarball & checksum (7z won’t work) of latest edition (e.g.
Lakka-Switch.aarch64-5.0.tar
) or nightly builds (e.g.Lakka-Switch.aarch64-devbuild-v5.x-20240414-b9dd11f.tar
) and place it tosdmc:/lakka/storage/.update/
AS IS, no need to unarchive or rename or whatever
Emulation
- Emulator
- Ryubing/Ryujinx
- new features & improvements
- Ryujinx Wiki
- Multiplayer‐(LDN‐Local‐Wireless), this is NOT online multiplayer alternative
- torzu, tor, clearnet mirror (less updated)
- Switch Firmwares
- Ryubing/Ryujinx
- Compatibility
YuzuRyujinxgone, new ryujinx-games-list is useless, non-existent on GreemDev/Ryujinx (for now)
- Cheats: check #Cheats
- Game Save & Shader Caches: TBD
EmuMMC Upgrade Guide
This only serves as a reference and many things are redacted.
- receive
Nintendo Switch 本体更新情報
from RSSHub - new releases waitlist
- hekate
- Atmosphère (prerelease)
- key & firmware dump (Lockpick_RCM & TegraExplorer)
- backup BOOT0 & BOOT1 in hekate, do NOT backup eMMC RAW GPP or GPP Partitions (as they are large)!
- backup & remove
atmosphere/contents/*
- update Atmosphère, hekate
- update #Cheats, #Amiibo & possibly other nro (from DeepSea/HATS)
- enter stock OS (sysNAND) & update firmware
- check if switch is banned
- dump
*.keys
in hekate using Lockpick_RCM - dump sysNAND firmware in hekate using TegraExplorer
- update firmware in emuMMC using Daybreak
- restore
atmosphere/contents/*
- check if titles are playable
- backup BOOT partition, transfer keys & update firmware in Suyu/Ryujinx/other places listed in #Payloads
TODO
- switch-ezremote-client
- Lakka Theme
- switch-lan-play
- Sega Saturn Emulation (modded COTTOn 2)
- FPS, clock speed, temperature monitoring and more, FPSLocker & FPSLocker-Warehouse
- SimpleModDownloader & SimpleModManager
- Kali on Switch
They are: Horizon OS (Stock OS), Atmosphère (CFW w/ emuMMC), Android 11/R (Switchroot), and Lakka (RetroArch w/ CPU & GPU overlocking). Depending on your understanding of operating system, it could be tri-boot or penta-boot. ↩︎